feat: manage Seriatim source prerequisites

README.md

@@ -4,8 +4,8 @@ Installs the [Seriatim](https://gitea.maximumdirect.net/eric/seriatim)
 transcript processor from source. The role supports Ubuntu 26.04 on `amd64`
 and `arm64` hosts and is independently usable outside the D&D pipeline role.
 
-At this point the role defines and validates its public contract; binary
-installation is added by subsequent implementation work.
+The role manages its build dependencies and a root-owned source checkout. At
+this point binary installation is added by subsequent implementation work.
 
 ## Requirements
 
@@ -37,6 +37,18 @@ ansible-galaxy collection install -r collections/requirements.yml
 For development revisions, set both `seriatim_source_ref` and an honest
 `seriatim_build_version`. Released deployments should select immutable tags.
 
+When `seriatim_manage_build_dependencies` is enabled, the role installs Git
+and converges the classic Go Snap to `seriatim_go_snap_channel`. When disabled,
+both Git and the configured Go executable must already be available, and Go
+must be version 1.25 or newer.
+
+The checkout is authoritative: tracked changes and all untracked or ignored
+files beneath `seriatim_source_dir` are discarded during convergence. The
+repository URL may point to a private remote, but authentication must be
+provided independently through the managed host's Git configuration or SSH
+environment; this role does not manage credentials or accept unknown host
+keys.
+
 ## Static validation
 
 ```sh

tasks/dependencies.yml

@@ -0,0 +1,66 @@
+---
+- name: Install Git build dependency
+  ansible.builtin.apt:
+    name: git
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  when: seriatim_manage_build_dependencies
+
+- name: Install Go build dependency
+  community.general.snap:
+    name: go
+    state: present
+    classic: true
+    channel: "{{ seriatim_go_snap_channel }}"
+  when: seriatim_manage_build_dependencies
+
+- name: Resolve Git executable
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/which
+      - git
+  register: seriatim_git_path_result
+  changed_when: false
+  failed_when: seriatim_git_path_result.rc != 0
+
+- name: Verify configured Go executable exists
+  ansible.builtin.stat:
+    path: "{{ seriatim_go_binary }}"
+    follow: true
+  register: seriatim_go_binary_stat
+
+- name: Require configured Go executable
+  ansible.builtin.assert:
+    that:
+      - seriatim_go_binary_stat.stat.exists
+      - seriatim_go_binary_stat.stat.isreg
+      - seriatim_go_binary_stat.stat.executable
+    fail_msg: "Configured Go executable is unavailable: {{ seriatim_go_binary }}"
+
+- name: Read Go compiler version
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_go_binary }}"
+      - version
+  register: seriatim_go_version_result
+  changed_when: false
+
+- name: Extract Go compiler version components
+  ansible.builtin.set_fact:
+    seriatim_go_version_parts: >-
+      {{ seriatim_go_version_result.stdout
+         | regex_findall('go([0-9]+)\.([0-9]+)')
+         | first
+         | default([]) }}
+
+- name: Require supported Go compiler version
+  ansible.builtin.assert:
+    that:
+      - seriatim_go_version_result.stdout is regex('^go version go[0-9]+\.[0-9]+(?:\.[0-9]+)? ')
+      - seriatim_go_version_parts | length == 2
+      - (seriatim_go_version_parts[0] | int > 1) or
+        (seriatim_go_version_parts[0] | int == 1 and seriatim_go_version_parts[1] | int >= 25)
+    fail_msg: >-
+      Seriatim requires Go 1.25 or newer; detected
+      {{ seriatim_go_version_result.stdout | default('no usable version output') }}.

tasks/main.yml

@@ -1,3 +1,9 @@
 ---
 - name: Validate Seriatim role inputs
   ansible.builtin.import_tasks: validate.yml
+
+- name: Manage Seriatim build dependencies
+  ansible.builtin.import_tasks: dependencies.yml
+
+- name: Manage Seriatim source checkout
+  ansible.builtin.import_tasks: source.yml

tasks/source.yml

@@ -0,0 +1,76 @@
+---
+- name: Create Seriatim source parent directory
+  ansible.builtin.file:
+    path: "{{ seriatim_source_dir | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Check out selected Seriatim source
+  ansible.builtin.git:
+    repo: "{{ seriatim_repository_url }}"
+    dest: "{{ seriatim_source_dir }}"
+    version: "{{ seriatim_source_ref }}"
+    update: true
+    force: true
+    accept_hostkey: false
+
+- name: Inspect Seriatim checkout cleanliness
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - status
+      - --porcelain
+      - --untracked-files=all
+      - --ignored
+  register: seriatim_source_status
+  changed_when: false
+
+- name: Reset tracked Seriatim source changes
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - reset
+      - --hard
+      - HEAD
+  when: seriatim_source_status.stdout | length > 0
+  changed_when: true
+
+- name: Remove untracked and ignored Seriatim source content
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - clean
+      - -dffx
+  when: seriatim_source_status.stdout | length > 0
+  changed_when: true
+
+- name: Enforce Seriatim source ownership
+  ansible.builtin.file:
+    path: "{{ seriatim_source_dir }}"
+    state: directory
+    owner: root
+    group: root
+    recurse: true
+
+- name: Resolve selected Seriatim source commit
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - rev-parse
+      - HEAD
+  register: seriatim_source_commit_result
+  changed_when: false
+
+- name: Record selected Seriatim source commit
+  ansible.builtin.set_fact:
+    seriatim_source_commit: "{{ seriatim_source_commit_result.stdout }}"

tasks/validate.yml

@@ -23,7 +23,7 @@
       - seriatim_go_build_flags | select('equalto', '') | list | length == 0
       - seriatim_go_ldflags | length > 0
       - seriatim_go_package | length > 0
-      - seriatim_build_version is not regex('.*\\s+.*')
+      - seriatim_build_version is not regex('.*\s+.*')
     fail_msg: Seriatim repository, revision, build, and Go values must be nonempty, and the build version cannot contain whitespace.
 
 - name: Verify managed Seriatim paths are safe and distinct